Analysis
- max time kernel
95s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
09/01/2025, 00:19
General
- Target 36ae428235152e37ae0e399cadefbf582611d03ac63f6a342d86ec51e69d5a10.exe
- Size 598KB
- Sample250109-al64dsslej
- SHA256 36ae428235152e37ae0e399cadefbf582611d03ac63f6a342d86ec51e69d5a10
Malware Config
Signatures
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Revengerat family
- RevengeRat Executable 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36ae428235152e37ae0e399cadefbf582611d03ac63f6a342d86ec51e69d5a10.exe"C:\Users\Admin\AppData\Local\Temp\36ae428235152e37ae0e399cadefbf582611d03ac63f6a342d86ec51e69d5a10.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -54418863 -chipde -0e55874a34074d45adbbbdd3c6c68fc5 - -BLUB1 -zsbbpcgmliplxldq -7864902⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ocs_v71a.exe
zsbbpcgmliplxldq.dat
memory/5008-17-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-18-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-11-0x000000001BB30000-0x000000001BBD6000-memory.dmp
memory/5008-12-0x000000001BCA0000-0x000000001BD3C000-memory.dmp
memory/5008-13-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-14-0x0000000000AC0000-0x0000000000AC8000-memory.dmp
memory/5008-9-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-16-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-8-0x00007FFF66735000-0x00007FFF66736000-memory.dmp
memory/5008-10-0x000000001B660000-0x000000001BB2E000-memory.dmp
memory/5008-19-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-20-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-21-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-22-0x00007FFF66735000-0x00007FFF66736000-memory.dmp
memory/5008-23-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-24-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-25-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp
memory/5008-27-0x00007FFF66480000-0x00007FFF66E21000-memory.dmp